Hacker News Reader

Another good example of an awful implementation can be seen in Google Workspace. Sometimes the crappy ML algorithms will generate a false positive and suspend an account for a suspicious login. Fine. I get it. It’s hard to do at scale and nothing’s perfect.

The thing I’d like to have Google explain to me is why they think it’s a good idea to bounce incoming mail for a user that’s been auto-suspended by an algorithm. In what scenario would I want that, especially when the account is locked at 3:00 AM local time?

That’s something that actually happened to me this weekend. For anyone at Google, NO ONE wants their incoming email bounced because of your crappy ML algorithms.

Same thing happened to me yesterday, I had to switch my MX records over to fastmail as that was easier than trying to figure out how to resolve the issue with Google directly.

I had been forwarding all of my email from my domain to my personal Gmail (the irony) so haven't lost anything except a Sundays worth of incoming emails which bounced.

In my case I was still using a free account for my custom domain, grandfathered in. I guess I get what I paid for...

Was it your admin account that got locked? That's a big fear of mine. If so, did you have any of the account recovery options set up? Ex: 2FA, phone number, recovery email, etc.?

IMHO a lot of account "security" is intentionally made to be overly aggressive so tech companies can lock your account and verify your ID / get your phone number. If you're using anything for business the only option is to diligently set up all the recovery options that are available, even though that means giving them a ton of personal information.

Yeah, locked my primary account and the admin account. There was no option to use any recovery options that I could see.

And today I get an email saying my accounts are now enabled?

The computers are definitely in control.

Glad I was forced to move away at this point, locking accounts is one thing, but bouncing emails not cool.

It's rife in the industry. The drama this week is that my wife can't log in to Facebook because their code generator just doesn't work. The number in the app shows up, she types it, but she can't log in because apparently it's just wrong.

Due to their marvelous design, you need a personal account to run an advertising account for your place of work. Luckily she hasn't been logged out on her work laptop yet or she couldn't do a large part of her job.

Business support? Yeah good luck, try googling and you'll get pages of dead links or suggestions to click something when you're already logged in.

If you haven’t already, check the time / date / timezone on the device that is generating the codes. Facebook uses TOTP for this, which is time-based. If the time on your device is wrong, the codes will be wrong. I would expect this problem to pop up more frequently this time of year due to errors relating to daylight saving time.

DST has nothing to do with TOTP. The TOTP spec specifies that unix time has to be used as the time source, which does not have DST.

That doesn't matter, DST-related events can still break TOTP.

Example: Device is set to the wrong timezone. It’s nearby, but the difference between the two timezones is that one has DST and one doesn’t. DST comes along, either the time changes by an hour when it isn’t supposed to, or it doesn’t change when it is supposed to. The most visible thing that looks broken to the user is not the timezone, but the time. So they adjust the time. The user-visible clock is now “correct” for the next six months as far as the user sees, but the system clock – including UNIX timestamps – is incorrect by an hour. This results in broken TOTP.

I find this awfully thin. About every device that does TOTP by default takes its time from the network provider, and lets the user set the correct timezone, and makes it even really easy to do so. Since most DST settings for timezones in the world are quite predictable (yes I am aware that there are few that have last-minute changes, but most don't, especially not in developed nations), most people never have to adjust their timezone because of DST.

Though I do suspect that Google Authenticator even has some logic to reduce these problems, since you can "sync" its time in the settings.

“Lets the user set the correct timezone” is where this falls down. The user doesn’t always get this right. Once that happens, the time looks correct for a while, then looks wrong all of a sudden. So they go into their settings and manually change the time. At that point taking time from the network provider no longer happens, because they overrode that.

The predictability of DST doesn’t help, and “most people never have to adjust their timezone” isn’t relevant either. Perhaps you didn’t fully grasp what was happening in the example? All of the machinery works correctly, it’s just the first time they set up the computer the timezone was wrong, or they moved. Everything after that point can work correctly, but if that thing is wrong, UNIX time will be wrong even if the time looks right to the user.

I’ve literally had to fix this problem for people. “Correct” time, incorrect timezone. It’s not a theoretical example.

> check the time / date / timezone on the device that is generating the codes.

Sounds like that'd be on the FB infrastructure side though?

The clocks on both devices (i.e. fb's server and your phone) need to be fairly closely synchronised. TOTP effectively encrypts a timestamp using a shared secret then decrypts it on the other side and checks you're within some bound. If either clock is out it won't work.

TOTP generates the codes on both the client and server sides. The user enters the client generated code and the server validates it.

So if the time on the client device is wrong (perhaps it was manually set and not updated for daylight savings), then the server will disagree with what the code should be.

It's the FB app on a new iPhone, set to Sydney where we live. There are no DST options I assume "it just works" covers all that.

There is an option to resync inside the FB app, which refreshes and... doesn't change a thing.

Your advice is appareciated though and I'll keep it in mind for the future.

Back to my original comment though. Want support? Maybe you will go to https://www.facebook.com/business/help and read the part that says "Find answers or contact support" and click the button.

This brings up an overlay with the usual SaaS buffet of simple answers for simple questions and not too much else. Click on one, don't find your answer, but wait! There is a message under it!

"Need more help? Contact support."

Yet no link. No button. Just dead text.

This is how multi-billion dollar companies operate in the 21st century.

This is a prime example of why Google and Apple's mobile app distribution duopoly needs to be disrupted. They're poor stewards of this space, and they've kept an iron grip on the mobile app market for over a decade, now.

Makes sense. The best thing you can do with Google is to stay as far away as possible.

Smartphone app development is a poor investment. Just build a good website.

That brings up a question I've had -- so many web sites seem to work better as an app. Is that because app development is easier, or is there some things that you can do with an app that you can't do through web standards? Specifically what types of items can't be [easily] done as a web app but are easy as a smartphone app?

Push notifications. One of the primary reasons why companies haven't switched to PWA for simple apps.

Then what is that popup I get all the time visiting sites that says "Allow site xyz to send notifications"? Is that different than push notifications?

Doesn't work on Safari / iOS.

App push notifications can be silent, but web based notifications can't. That means you can push updated content without disturbing the user in an app, but not for a webpage.

I would rather just get an email at this point.

Mostly its just about user data and money. It's AOL all over again. Only this time, they just might win.

Apple refuses to implement standards that make web applications usable on mobile devices, even though Chrome and Firefox have supported them for ages.

It's because the web was developed as a means for delivering documents and app development has been bolted on as an afterthought.

Unfortunately, Apple refuses to implement basic features into Safari that Chrome and Firefox have supported for a while, and they refuse to allow developers to use browser engines other than the embedded Safari on iOS. This forces developers to release iOS apps if they want to target iOS users.

What we need is some anti-trust litigation with teeth.

What features?

Notifications is the big one. Only way to push a notification to a user on iOS is to have an app (even through Safari on desktop supports notifications).

Web notifications aren’t power efficient the way APNS notifications are.

That’s why it’s easy to build support for it on Desktop safari but not iOS.

I except they’ll support Web notifications on iOS once the technology is mature enough to meet the power budget.

web notifications work exactly the same way APNS do. If OS vendors are reasonable and expose the APIs needed to use them efficently that is.

This is not correct. Web push notifications rely on running a persistent service worker in a JavaScript runtime, which is not anything at all like how they are received by native iOS Apps.

Additionally with iOS apps, Apple can and does work directly with developers whose apps are overusing the notification system and draining power, which they cannot do with arbitrary web apps.

> What we need is some anti-trust litigation with teeth.

Indeed. We need big tech to divest some of their eye watering profits into actual user support. With so much depending on tech, kicking out users at a whimsical ML bit flip can be super damaging.

Some Google employee usually chimes in on these to provide a link to some forum where if you just follow these specific steps for one specific problem, you might be able to fix it. But it ignores everyone else who doesn't fit into that narrow range. Google has worse customer service than Comcast.

I really don't understand why google doesn't offer some sort of human support. It's not terribly hard to implement something that is revenue neutral (or even positive), and the customers with the most money to spend are really going to want it.

Because they’re a “tech” company through and through and to them it’s a step backwards.